Slashdot Mirror
Long-Term Liability For One-Time Security Breaches?
An anonymous reader writes "Not a month goes by where we don't hear about a theft of some organization's laptop containing sensitive personal information, not to mention the even more frequent — but often kept secret — breaches into company networks and databases. It is definitely true that you should be responsible for the security of your information when you handle it, but what happens when the theft of your information is not your fault? You have handed over this information to a company or organization and trusted them to keep is secure, but they failed. They might notify you of the breach or theft, and they might even set up a credit monitoring service for you for a year or two, but the problem is that this information may be used years from now. Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?"
But we give it too much power to allow that. A much more fundamental change is needed. Until then, long term liability is probably the only alternative. It should never cost the victim anything at all. All costs should be laid on the leaker. And "Trust no one" with your info still applies.
For justice, we must go to Don Corleone
Not to sound condescending, but when you hand your stuff over to a third party generally there is a contract signed between you and them, what you are looking for *should* be in that contract.
crazy dynamite monkey
the real reason we hear more about it and hear of more of them every day is because they are the media topic of the moment, just like when northern rock was in trouble, suddenly, all the banks where in trouble and everyone took their money and caused the financial meltdown.
in short, this sort of thing isnt happening more frequently than it previously was, its just being reported on more
portfolio
The first oddity is why the author believes that the data would sit around for years before being used. Like there's an "exploit bank" where you can deposit your collection of stolen data and gain interest on it until you "cash them in". I'd think far more likely it'll get used fairly rapidly, or never. How you fence or launder millions of records is kind of a mystery to begin with.
The second oddity is we are mostly dealing with the bottom percentiles of personnel, equipment, hardware, software, and design. So the article blissfully dreams "Let's hope that these reasonable measures will include the use of encryption." But you know that fools are just going to add another column to the database called "encryption key" so as to decode the other columns. Or store the key in C:\key.txt. Or go all ROT-13 or whatever the unicode version is of ROT-13. If you're dealing with screwups, adding more conditions just makes their screwups more rube goldberg and hilarious, it doesn't prevent them from screwing up.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Yes, seriously, if the informations is that important, why is it on a unencrypted laptop HDD ??
Your security should be more costly to bypass than what the security is protecting. If you can't do this, you're making a business proposition to the world: "Hey, free profit at my expense. Inquire Within." If you don't want to pay to protect it properly, then the best you can hope for is that someone else's stuff is more shiny than yours.
#fuckbeta #iamslashdot #dicemustdie
That all of the really useful data tends to have infinite life (birthdate, SSN or equiv for non-US, place of birth) compounds the problem (the "use case" that comes to mind is some aged drive surfaces in the used parts market and some scofflaw procures it and uses it long after the breach itself).
Obviously, each organization should have their own ID numbers, and any given "customer" ID should be able to be associated with various time varying external credentials and really good stuff which isn't time varying shouldn't be in the hands of third parties.
Regulators (e.g. SOX, HIPPA, UK data protection act(s)) all seem to miss the boat about limiting the scope of breeches. Legislating that no breech ever occur is laudable, but impractical. So minimizing the harm done should be the focus.
> Is it fair that you have to worry for decades and pay for further credit
> monitoring when they are to blame for your information ending up in the
> wrong hands?
You are liable for the actions of your agents. If they screwed up you can sue them but you are still responsible to your customers.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
TFA is the summary segued into mentioning the Data Accountability and Trust Act is before the Sentate. Here is the tracking site for that act, and the important Summary:
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221&tab=summary
It's fairly straightforward. It defines terms and requires the information holders to follow a structured method of protection and reporting. Places oversight with the FTC. Notably "Prohibits the FTC ... from requiring the deployment or use of any specific products or technologies." Does not mention encryption.
But also note this is hardly the first time such a bill has been presented.
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221&tab=related
Nor is there mention of what bizarre shotgun-marriage legislation this bill is combined with, or indicates what kind of support there currently is for this bill.
I don't know... I'm horribly cynical about this sort of thing. But one good result might be that legislated and audited & enforced care of personal information (simple as name + credit card number) might finally make sites and services not just a little more careful with databases, but start to question whether they should have them at all. Right now, there's nearly no costs or responsibility overhead for collecting everything you can about your customers, and passers by. This bill makes it costly; that'll limit businesses to acquiring (and holding) only the information they need to conduct business.
Still, I'd like to see specific time limits on holding things like credit card number after a transaction, and very specific limit on sharing that information with "partners" etc. Also I'd like to see my "conduct business" above limited to processing the original transaction with you; that the personal information acquired cannot be used to make money in any other way whatsoever.
(Sorry for doing your job, Soulskill, by supplying those links. Perhaps you could add the car analogy?)
I feel that the information I share is at my own peril. Perhaps we should worry less about data security and invest more energy in learning how to get stuff done without the need to share important info in the first place.
This is probably about identity theft and getting e.g. loans by simply knowing the "magic" numbers of someone else's life.
...) to let them check if you are really the person you claim to be? Makes it a lot more difficult to get these things, and shifts liability back to the banks (if you can show you never went there to prove your identity, they screwed up by giving that loan - their fault).
Why is it still possible to get these things in the US without going into e.g. a bank and showing them a valid photo ID (passport, driver license,
If you've got a problem with a bank seeing you in person (why?), maybe a new institution could be founded that does only that: Check IDs of people for others. Like this:
1. Request a loan
2. Get a unique magic number of your bank that doesn't carry any information but the bank knows it belongs to you and that loan
3. go to the ID-check-service and let them sign that number, e.g. with: "Person xyz has proven his identity" (if paperwork, or better get a digital signature)
4. Give signed number back to the bank
Bank knows you are you, without you ever going there in person and the ID-check-service doesn't know what you needed that signature for (they just got a "random" number and signed it for a fee).
Expand this scheme for other services (governmental, etc.) and you get all the privacy you got now with a whole bunch of more security.
This is a ridiculous game we keep playing over and over again. We have "secret information" we entrust to every business entity with which we do transactions. They aren't quite as secret any longer. And these other entities have people in them... not all of them can be trusted and you will never know who or how many whos have had access to the information. It's a very flawed system especially in light of modern communications technologies available today.
We need a system in which credentials for transactions are good for one-time-only. I present my credit/debit card and this information doesn't change again until either the expiration date arrives or I have it changed. But if I do something with my account "device" that issues a payment ticket number (rather like a cheque in many respects) that is then presented to the business entity to be used only by that business entity and only works once, twice or however often it can be used as approved by you. That code would only be useful for the other side of the transaction because of their encryption key token must work with the ticket number I issued. Then these stupid open secrets won't need to be a concern any longer.
The big problem isn't that people can or can't securely store this information because we already know it can't ever be stored safely and also be useful. So it needs to be stored "safely enough" but also with limited usability. What it all comes down to is a system that requires end-to-end user accountability. As it stands now, "identity theft victims" are held accountable for EVERYONE's mistakes. It's just not fair.
The correct term is "data breach", not "data breech."
A "breech" is either a pair of short pants ("breeches"), the hind end of the body or a birth where the baby is coming out backward ("breech birth"), or the rear of the barrel of a firearm.
So the term "data breech" means short pants made from data, data that is coming out of a system backward, or the back end of an Ethernet cable, I suppose.
This teaching moment sponsored a chunk of my karma from the inevitable "Offtopic" and "Troll" mods this post will undoubtedly earn me.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
Not everyone has the choice to "man up".
I could go on numerous examples but the biggest would be mandatory disclosure of information to an incompetent government.
And don't even think of telling me that "I could always choose to go to jail" when doing so means I get my prints and mug shot forcibly taken anyway.
What if you're trying to get your first mobile phone?
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
The cost of a company's mastakes are a cost of doing business. Why should I pay for your mistakes? I'd rather the company go out of business, even all companies like it, than let them continue with shoddy security that may cost me dearly. If they aren't made to pay for their mistakes, the mistakes will continue to be made.
You have morals, but corporations do not.
Free Martian Whores!